Hide Forgot
Description of problem: SSSD shipped in 6.0 with the expectation that HBAC rules would be stored in the cn=account subtree of FreeIPAv2. However, the final version of the schema stores them in cn=hbac instead. So right now, there are no rules accepted (which means denial of all) Version-Release number of selected component (if applicable): sssd-1.2.1-28.el6_0.4 How reproducible: Every time Steps to Reproduce: 1. Set up a FreeIPA v2 server with one or more HBAC rules 2. Point an SSSD client at this server, with access_provider=ipa Actual results: User is always denied Expected results: Denial/permission should be based on the access control rules Additional info:
Verified server ipa-server-2.0.0-13.el6.x86_64 client: ipa-client-2.0.0-13.el6.x86_64 sssd-1.5.1-10.el6.x86_64 [root@ipaqavmh ~]# ipa hbacrule-show testdenyssh Rule name: testdenyssh Rule type: deny Source host category: all Description: test deny Enabled: TRUE Users: mmouse Hosts: ipaqavmh.rhts.eng.bos.redhat.com Services: sshd Mar 1 10:04:21 ipaqavmh sshd[13984]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=hp-dl180g6-01.rhts.eng.bos.redhat.com user=mmouse Mar 1 10:04:21 ipaqavmh sshd[13984]: pam_sss(sshd:account): Access denied for user mmouse: 6 (Permission denied
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2011-0560.html